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Abstract 

The goal of an infection source node (e.g., a rumor or computer virus source) in a network is to 
spread its infection to as many nodes as possible, while remaining hidden from the network administrator. 

On the other hand, the network administrator aims to identify the source node based on knowledge of 
which nodes have been infected. We model the infection spreading and source identification problem 
as a strategic game, where the infection source and the network administrator are the two players. 

As the Jordan center estimator is a minimax source estimator that has been shown to be robust in 
recent works, we assume that the network administrator utilizes a source estimation strategy that can 
probe any nodes within a given radius of the Jordan center. Given any estimation strategy, we design a 
best-response infection strategy for the source. Given any infection strategy, we design a best-response 
estimation strategy for the network administrator. We derive conditions under which a Nash equilibrium 
of the strategic game exists. Simulations in both synthetic and real-world networks demonstrate that our 
proposed infection strategy infects more nodes while maintaining the same safety margin between the 
true source node and the Jordan center source estimator. 
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I. Introduction 

With the increasing popularity of online social networks l ik e Facebook, Twitter and Google+ 171-141- 
more and more people are getting news and information via social networks instead of traditional media 
outlets. According to a study from the Pew Research Center, about 30% of Americans now get news from 
Facebook 0. Due to the interactive nature of online social networks, instead of passively consuming 
news, half of social networks users actively share or repost news stories, images or video, and 46% of 
them discuss news issues within their social circles 0. As a result, a piece of information or a rumor 
posted by a social network user can be reposted by other users and spread quickly on the underlying 
social network and reach a large number of users in a short period of time 0-0. We say that such users 
or nodes in the network are “infected”. A widely spread rumor or misinformation can lead to reputation 
damage 0, political consequences fTOll . and economic damage fill . The network administrator may 
want to identify the rumor source in order to catch the culprit, control the damage, and counter the rumor 
influence. Here, the term “network administrator” is used in a very broad sense to include anyone (e.g., 
regulatory authorities and researchers) who has been given access to data about the network topology 
and infected nodes. 

Another example of an infection spreading is that of a malicious node in a computer network whose 
goal is to spread a virus throughout the network. The virus can be a spam hot that is not easily detected 
lfT2l (e.g., when the Mariposa botnet was dismantled in 2009, it had infected over 8 million computers 
QjJ), and the network administrator is alerted to the virus infection only at a much later time. Motivated 
by these applications, many recent research works fl4l - tfT9l have focused on the problem of identifying 
rumor or infection sources in a network under various spreading models. In all these works, the source 
is assumed to be “dumb”, and whether a susceptible node becomes infected or not follows a stochastic 
process that is not controlled by the source. Under this simplified assumption, the works |[T4l - llT9l show 
that source estimators can be constructed so that the true source can be identified with high probability 
to within a fixed number of hops. 

In many applications, the source may wish to maintain anonymity while spreading the infection to as 
many users as possible. An example is the now defunct anonymous social networking app Secret f20l , 
which allowed smart phone users to share information and repost a posting anonymously among his 
device contacts or Facebook friends. In February 2014, Secret was used to spread the false rumor that 
Evernote Corporation was going to be acquired, which prompted the CEO to subsequently issued a public 
denial GTI . Messaging services including Wickr Il22l and FireChat If23l have been used in civil protests 
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l ik e those in Hong Kong in 2014 J24[, fl25l . Government authorities may trace the initiators of certain 
protest events even if the messages are encrypted through the use of source identification algorithms that 
do not rely on message contents or metadata lfl4l - |[T8l . Therefore, in distributing information, civil protest 
leaders may design an infection strategy that carefully controls the rate of information spreading in order 
to obfuscate their identities. In the example of spam hot infection spreading, the perpetrator also wants 
an infection strategy that controls the rate of the virus spreading to avoid being caught by the authorities 
while spreading the virus to as many computers as possible. The recent work l26ll introduces a messaging 
protocol, which guarantees obfuscation of the source under the assumption that the network administrator 
utilizes the maximum likelihood (ML) estimator to identify the source, and when the underlying network 
is an infinite regular tree. Moreover, simulations are provided in ll26l to verify the performance of the 
messaging protocol on irregular trees and general networks. 

With prior knowledge that the infection source may try to avoid detection, the network administrator 
needs to adapt its estimation strategy to increase its chance of identifying the infection source. On the 
other hand, if the source has prior knowledge of the estimation strategy, it needs to further adapt its 
own infection strategy, and so on. The source and network administrator is thus playing a “hide and 
seek” game of infection spreading and source identification. This complex dynamic can be modeled as a 
strategic game with the source and network administrator as the two players of the game. To the best of 
our knowledge, studying infection spreading and source identification as a strategic game is novel since 
previous works like lfl~4l — ffl9ll focus only on the estimation strategy, while the work ll26l focuses only 
on the infection strategy. 

In this paper, we study best-response strategies for both the source and network administrator for trees 
from a game theoretic perspective, whereas ll26l develops an order-optimal infection strategy for the 
source for infinite regular trees (which are special cases of expanding trees), and extends heuristically 
to more general networks. In ll26l . the network administrator is assumed to adopt the ML estimation 
strategy, whereas we assume that the network administrator is allowed to tune a Jordan center based 
estimation strategy (see Section Hl-AI for justifications of our estimation strategy choice). In our current 
work, we assume that the network administrator becomes aware of the infection only when the number 
of infected nodes exceeds a given threshold, and only then it makes an observation of the infection status 
of the nodes. (The problem becomes trivial if the network administrator is constantly monitoring all the 
nodes in the network.) For example, a perpetrator who aims to manipulate the stock price of a company 
may start to spread a false rumor about the company on a social network. The regulatory authority do not 
have enough resources to monitor the whole network all the time and for all possible events. Therefore, it 
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becomes aware of the false rumor only when the number of infected nodes becomes sufficiently large. Our 
work can also be applied to the case where the source has an estimate of when the network administrator 
discovers the infection. This can be the case in the previous stock price manipulation example when the 
peipetrator first spreads a rumor within his social network using private messages to collude with other 
users, and then all colluding users post the rumor publicly on the stock’s initial public offering day in 
order to manipulate its price and profit from it. 

Our main contributions are the following: 

(i) We formulate a strategic game in which the network administrator and infection source are the 
players. The network administrator uses a source estimator in which it can probe any nodes within 
a given radius of a randomly chosen Jordan center of the observed infection graph. A larger probe 
or estimation radius ensures that the source can be identified but incurs a higher cost. The infection 
source uses an infection strategy in which the rate of infection over each edge in the network can 
be controlled in order to achieve a minimum safety margin to the Jordan centers. The source is 
rewarded for each infected node, and penalized if it is identified by the network administrator. 

(ii) Given a safety margin for the infection source, we show that the best-response strategy for the 
network administrator is to use the Jordan centers as the source estimator or adopt an estimation 
radius equal to the safety margin. We derive conditions under which each of these strategies are 
optimal. 

(iii) Given an estimation radius for the network administrator, we show that the optimal safety margin 
for the infection source when the underlying network is a tree, is either zero or one more than the 
estimation radius. We derive an infection strategy, called the Dominant Infection Strategy (DIS), 
which maximizes the number of infected nodes subject to a given safety margin. 

(iv) We derive conditions under which a Nash equilibrium for the strategic game in (0) exists. We show 
that when a Nash equilibrium exists, the best response for the network administrator is to adopt the 
Jordan center estimator. This gives a game-theoretic interpretation to the Jordan center estimator, 
in addition to being a universally robust estimator (which we showed previously in lfl9lD . 

Our problem of finding the best-response infection strategy is related to the influence maximization 
problem, which aims to find a subset of influential nodes to maximize the expected number of nodes 
that are “influenced” or infected by the chosen subset ll27l . ll28l . and is shown by lf29l to be a NP-hard 
optimization problem. Approximate solutions have been extensively investigated by various researchers 
Il30l - ll32l . The main difference between our work and the influence maximization problem is that the 
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source node in our problem is fixed, and we seek an infection strategy, given any source node, to maximize 
the set of infected nodes, subject to a safety margin to the Jordan center of the infection graph. 

The rest of this paper is organized as follows. In Section [Til we present the system model, assumptions 
and provide a game-theoretic problem formulation. In Section [Dll we show the best-response estimation 
strategy for the network administrator given any infection strategy. In Section [TV] we propose a best- 
response infection strategy for the source given any estimation strategy. In Section [V] we derive conditions 
under which a Nash equilibrium of the strategic game exists. We present simulation results in Section IVT1 
to evaluate the effectiveness of the proposed strategies on various synthetic and real networks. Finally 
we conclude and summarize in Section IVIII 

II. Problem Formulation 

In this section, we first describe our system model and assumptions, and then we provide a game- 
theoretic problem formulation for the infection spreading and source identification. 

Consider an undirected graph G(V,E) representing a social network, where V is the set of vertices 
or nodes, and E is the set of edges. Because of technical difficulties, our analysis and strategy design 
assume that G is a tree, as is commonly done in the literature fT4]l-|IT8l|, l(26l . We will however apply 
our strategies heuristically to general networks in our simulations in Section [VT] 

We assume that there is a single source node v* £ V at time 0. An infection can pass from one node 
to another. For example in the case of an online social network, a user may post a rumor he sees in the 
posting of his friend using his own account. An infected node remains infected throughout, and has the 
capability of infecting its neighbors at a deterministic rate. For any edge (i,j) <E E, we let /i(i. j) to be 
the time it takes for an infected node i to infect its susceptible neighbor j, which we call the infection 
time associated with the edge Let A (i,j) = 1 /n{i,j) be the infection rate of (i, j). For any pair 

of nodes v and u in G, let d(v, u) be the number of hops in the shortest path between v and u, which is 
also called the distance between v and u. For any edge (i,j) with d(v*,i ) = m and d(v*,j) = m + 1, we 
assume A (i,j) is uniformly upper bounded by a maximum infection rate \ m > 0. In examples like rumor 
spreading, A m is non-increasing in m as it becomes more difficult for an infected node further away from 
the source to infect another susceptible node. We assume that the network administrator observes one 
snapshot of all the infected nodes in the network, and tries to estimate the source at the time i 0 b s when 
the number of infected nodes first exceeds a threshold n 0 b s > 1. We call / obs the observation time, and 
n 0 bs the observation threshold. 
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For any time t > 0, let 


fc-i 


d(t) = max < k : A m x < t 


m =0 


(1) 


Since the infection rate of each edge is upper bounded by its respective A m , the maximum number of 
hops the infection can spread from the source in time t is d(t). We assume that the graph is sufficiently 
large so that d(t 0 b s ) < d(v*. V), i.e., the network administrator observes the infection graph before the 
infection can spread to all nodes in the network. 

For any pair of nodes v and u in G, let p(v, u) to be the shortest path from v to u, and the infection 
time of p(v, u) to be 


p{v,u) = Y 

(i,j)ep(v,u) 

^ A Jfj)' (2) 

{i,j)£p(v,u) 

The collection of infection rates A = {A(i, j) : (i. j) £ E} is called an infection strategy for the source 
node. Given any infection strategy A, we denote the set of infected nodes at time t 0 b s as 


Vi = {u £ G : p(v*,u) < f 0 b s }. (3) 

We sometimes use Vi (A) instead of Vi to indicate that the given set of infected nodes resulted from the 
infection strategy A. Let G\ to be the minimum connected subgraph of G that spans Vi, which we call 
the infection graph at time f 0 b s . 

Throughout this paper, we let \X\ denote the expected number of nodes in the random set X conditioned 
on the infection graph, and 1 a denote an indicator function with value 1 iff the clause A is true. 


A. Network Administrator 

At the observation time f 0 b s , the network administrator observes the infection graph G\, and tries to 
estimate the infection source. Although n 0 b s is known to the network administrator, since it does not 
know the starting time that the source begins its infection spreading, it does not know the amount of 
elapsed time f 0 b s . We assume that the network administrator can choose a subset of nodes to investigate, 
which we call the suspect set. It is important for the network administrator to decide which subset of 
nodes to investigate in order to minimize the cost and maximize its chance of identifying the infection 
source. In the same spirit as lfT4l - fT8l . the network administrator is assumed to have limited knowledge 
of the underlying infection spreading process, and its estimation strategy can only depend on the observed 
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infection graph G\. In the following, we present the definition of the Jordan center and then introduce a 
class of estimation strategies based on the Jordan center. 

Given any set A dV, denote the largest distance between v and any node u £ A to be 

d(v,A) = ma xd(v,u). 

uGA 

For any infection strategy A, we call the largest distance d(v, Vi) between v and any infected node the 
infection range of v. We let 

JC = {v : d(v,\ i) = mindbu, Vi)}, (4) 

uGG 

to be the set of nodes with minimum infection range, which are known as the Jordan centers of G\ l(33l . 
It is shown in fTTIl that if G is a tree, then |JC| < 2. 

When no prior knowledge of the infection source is available, any node in VJ is equally likely to be 
the source as infection rates over different edges can be heterogeneous. Therefore, a Jordan center is 
a minimax source estimator that minimizes the largest distance to any infected node. It has also been 
shown in fT71 - fl9l that the Jordan center is a robust source estimate. Another popular estimator is the ML 
estimator. However, lf26l shows that it is possible to design an infection strategy so that the probability of 
the ML estimator being the true source is approximately l/|Vi|, i.e., all the infected nodes are considered 
by the network administrator to be approximately equally likely to be the source. If f 0 b s is large, then 
the ML estimator performs badly. The Jordan center estimator does not have this problem since there are 
at most two Jordan centers in any tree. As such, we assume that the network administrator chooses the 
suspect set V sp (d a ) to be the set of infected nodes within d a > 0 hops from an arbitrarily chosen Jordan 
center u, i.e., 

V sp (d a ) = {w <E Vi : d(v,u ) < d a }. (5) 

We call d a the estimation radius. Note that V sp (d a ) depends only on the observed infection graph Vi. 
The strategy of the network administrator is denoted using d a . 

We let d s to be the distance between the actual source and the Jordan centers, i.e., 

d s ( A) = min d(v*,u). (6) 

liGJC 

We call g? s (A) the safety margin of the source achieved by the infection strategy A. 

If d a > c4(A), then the infection source is in the suspect set, and the network administrator has a 
non-negative probability of identifying the source. The network administrator obtains an expected gain 
g a (d a , Vi), which we assume to be non-increasing in d a . For example, if the network administrator only 
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has access to the infection graph and has no additional prior information, its best strategy is to uniformly 
choose a node from the set of suspects as the estimated source node. Its expected reward is then inversely 
proportional to the number of nodes in V^ p (d a ). In another application, the network administrator may 
have side information that allows it to always correctly identify the source node if it is included in the 
suspect set. In this case, we let the expected reward to be g a (d a , Vi) = g a ■ Some positive cost c a (V sp (d a )) 
is incurred for probing nodes in V sp (d a ). We assume that c a (V sp (d a )) is an increasing function of the 
estimation radius d a . We let the utility function of the network administrator be 

Ua{d a , A) = C a (V sp (da)) + ga{dai ^i)>d a (A) ■ (7) 

The network administrator’s utility function depends on A only through its infection graph V\, which the 
administrator observes at time t 0 b s , and the safety margin d s ( A). Although the network administrator’s 
utility function depends on the safety margin of the source, it does not know a priori the safety margin 
chosen by the source. In this paper we perform a game theoretic analysis of the estimation strategy used. 

B. Infection Source 

Suppose that the network administrator uses an estimation radius of d a > 0. We assume that the 
observation time f 0 b s is unknown to the infection source, but the source knows the infection threshold 
n 0 bs at which the network administrator will attempt to identify it. We show in Section JV] that t 0 b s can be 
computed from n 0 b s . For each node that is infected, the source is rewarded with a gain g s . A positive cost 
c s (d a ) is incurred if it falls within the suspect set of the network administrator. We assume that c s (d a ) 
is a non-decreasing function of the estimation radius d a ■ The utility function of the source adopting the 
infection strategy A is given by 

Us(d a ,A) = 5s |V,| Cs(^a)l<i 0 >d s (A)- (8) 


C. Strategic Game 

We model the infection spreading and source identification as a strategic game where the network 
administrator and the infection source are the two players. The utility functions of the two players are 
given in ([7]) and ©, respectively. Given any infection strategy A (or more specifically, the safety margin 
d s ( A)), the network administrator finds the best-response estimation strategy with estimation radius d* 
that maximizes its utility function, i.e., 

d* a = arg max u a (d a , A). 
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On the other hand, given any estimation radius d a , the infection source finds the best-response infection 
strategy A* that maximizes its utility function, i.e., 

A* = arg maxu s (d fl , A). 

A 

If there exists a pair (d*, A*) such that given A*, the best-response estimation strategy has estimation 
radius d*; and given d*, the best-response infection strategy is A*, then (d* . A*) is a Nash equilibrium 
of the strategic game 041 . 

In Sections [TIT] and [TV] we find the best-response estimation strategy and the best-response infection 
strategy for the network administrator and the infection source, respectively. In Section [V] we derive the 
Nash equilibrium of the strategic game. 

TIT. Best-response Estimation Strategy for the Network Administrator 

In this section, we derive the best-response estimation strategy for the network administrator. In this 
paper, we assume that the network administrator utilizes the Jordan center based estimation strategy, 
which is characterized by the estimation radius d a . Given the infection strategy A with safety margin 
d s ( A) = d s , the network administrator chooses an optimal estimation radius to maximize its utility 
function. 

We first consider the case where d s = 0. In this case, the inequality d n > d s always holds. From <[7]>, 
the network administrator’s utility function becomes 

lta(daj A) — C a (V sp (d a )) T Qa(daiX'l), 

which is decreasing in d a . Therefore, the optimal estimation radius is given by d a = 0. 

Now suppose that d s > 0. We claim that the estimation radius of a best-response estimation strategy 
is either 0 or d s . To prove this claim, it suffices to show the following inequalities: 


Ua(0, A) > u a (d' a , A), 

(0,d s ); 

(9) 

^a(^s? A) > u a (d a . A), 

V d' a > d s + 1. 

(10) 


We first show the inequality ([9]). Since 0 < d' a < d s , the gains for both the estimation strategy 
with d a = 0 and the estimation strategy with d a = d' a are 0. The inequality ([9]) then holds because 
c a (Vs P (0)) < c„(V; p «J). We next show the inequality (flQl) . The inequality d„ > d s holds for both the 
estimation strategy with d a = d s and the estimation strategy with d a = d' a > d s + 1. Since c a (V sp (d s )) < 
c-n( Vsp( d ! a )) and g a (d s , Vf) > g a {d' a , Vi), the inequality ( flQl ) holds. This completes the proof of the claim. 
The following theorem then follows immediately. 
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Theorem 1. Suppose that the infection source adopts the infection strategy A with safety margin d s { A) = 
d s . If d s = 0, the estimation radius d* a of the best-response estimation strategy is 0. If d s > 0, the 
estimation radius of the best-response estimation strategy is given by 


<=< 


o, 

ds j 


if 9a(d s ,V j) < Ca(^ / sp(^s)) 
if 9a{d s ,V j) > Ca(^ / sp(^s)) 


0 or d s , if g a (d s ,Vi) = c a (V sp (d s )) 


Ca(^sp(0)), 

Ca(^p(0)), 

c a (V;p(0)). 


(ID 


We remind the reader that the quantities g a {d s , V\) and V sp (d s ) in Theorem Q] depend on the infection 
strategy A only through the infection graph V\ observed by the network administrator. Therefore, given 
the safety margin d s , the network administrator can formulate its best response using Theorem Q] without 
knowing the source utility function. 

We observe that if d s > 0 in Theorem [Q then using an estimation radius of d* = 0 implies that 
the network administrator has zero probability of identifying the infection source. This happens when 
the reward of catching the infection source is significantly lower than the cost of probing more nodes. 
In practical systems, attempts should be made to keep the cost of probing each node in the network 
sufficiently small so that the infection source can be identified with positive probability. On the other 
hand, our result also points to the intuitive conclusion that for a source to escape identification with 
probability one, the infection observation time f obs must be sufficiently long (cf. Theorem |2j, and the 
source’s safety margin must be chosen to be sufficiently large so that c a (V sp (d s )) — c a (14 P (0)) is large 
and the first case in (fill) holds. 


IV. Best-response Infection Strategy for the Infection Source in a Tree 

In this section, we derive a best-response infection strategy for the infection source for the case where 
the underlying graph G is a tree. We assume that the infection source knows the observation threshold 
n G bs but not the observation time f obs . We first derive our infection strategy based on the observation time 
fobs, and show how to compute t 0 b s from n 0 b s - 

Given an estimation radius d a and an observation time t, the source designs a best-response infection 
strategy that maximizes its utility function. We first introduce the notion of a maximum infection strategy. 
Let ||A|| denote the infection size of the infection strategy A. 

Definition 1. Given any safety margin d s and observation time t, we define the maximum infection 
strategy with safety margin d s to be the infection strategy that maximizes the number of infected nodes at 
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time t among all infection strategies that achieve the safety margin d s . Let the set of maximum infection 
strategies with safety margin d s be AT (d s , t). 

For each estimation radius d a , we design a best-response infection strategy A* for the infection source 
in three steps: 

• Step 1: Given any safety margin d s and any observation time t, we find a maximum infection strategy 

A-d s ,t £ -M.(d s ,t). 

• Step 2: We search for the smallest t such that ||Arf ajt || > ra 0 b s , and set i 0 b s = t. 

• Step 3: Among all maximum infection strategies found in Step 2, we find one that maximizes the 
source’s utility function as the best-response infection strategy, i.e., an infection strategy A* = Ad;,t obs 
where 

d* = arg max u s (d a , A ds iUs ). 
d s 

Note that under a given safety margin constraint d s and observation time t, the source’s utility u s (-, ■) 
is invariant to which infection strategy is chosen from M(d s ,t). In the following, we first determine the 
range of values that the safety margin d s can take for given set of maximum infection rates {A m }, and 
observation time t, i.e., those values of d s such that A 4(d s ,t) 0. We call such a safety margin feasible. 
It is clear that AT(0 ,t) = {A max }, where A max is the infection strategy in which each node at distance 
m from the source is infected at its respective maximum rate A m _i. We next propose an algorithm to 
find an infection strategy in A 4(d s ,t), for all feasible d s > 0. 


A. Maximum Infection Strategy with Safety Margin Constraint 

Given any observation time t, it turns out that not all values of d s are feasible. To see this, consider an 
infection spreading along a linear network. Since the maximum number of hops the infection can spread 
from the source is d(t) (cf. dTJ), the safety margin cannot be more than \ d(t)/2\. The following theorem 
provides the achievable upper bound for the safety margin in a tree. The proof is in Appendix |A] 


Theorem 2. Suppose the underlying graph G is a tree. For any given observation time t, the largest 
feasible safety margin is 


ds — 


d{t) 

2 


( 12 ) 


From Theorem [2} we see that the safety margin of any infection strategy can take values only from the 
set [0, d s \. Given a feasible safety margin d s , we next show how to design a maximum infection strategy 
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A d s ,t £ M(d s ,t). In the rest of this section, we adopt the following notations: Let G\j be the infection 
graph at observation time t generated by a given infection strategy, which will be clear from the context. 
Let T u to be the subtree of G\ f rooted at node u with the first link in the path from u to the source node 
v* removed. Let l u to be a leaf node in T n that has maximum distance from u, i.e., 

l u G {'< £ T u : d(u,i) = ma xd(u,j)}. (13) 

j&T u 

We start by defining a dominant path and showing an elementary result related to this definition. 

Definition 2. For any obserx’ation time t, a dominant path is a path between the source v* and any node 
in the infection graph G\ j that has the maximum distance. 

Lemma 1. Suppose that G is a tree. Consider a maximum infection strategy with a feasible safety margin 
d s that results in an infection graph G\ t at time t. Then, the infection along each edge in any dominant 
path of G\ j has maximum infection rate X m if the endpoint of the edge closer to the source is at distance 
m from it. 

The proof of Lemma Q] is provided in Appendix [B] To get a safety margin d s > 0, the intuition is to 
construct one dominant path P,y starting at v* so that the Jordan center is biased towards the leaf node at the 
other end of P,/, which in turn results in a safety margin d s . We discuss how to select an optimal dominant 
path in Algorithm Q] For now, we assume that a dominant path Pd is given. Our proposed DIS(d s ,t) 
strategy, given in Strategy [Q is defined by a set of parameters, {A m : m € [0. d(f) — 1]}. Consider any 
infected node i on the path Pd. Suppose d(v*,i ) = m and let j be the susceptible neighboring node of 
i on P,i- The node i infects j with rate X m and infects all its other susceptible neighbors with rate X m . 
On the other hand, for any infected node that is not on Pd, it infects all its susceptible neighbors with 
the same rate that it itself was previously infected. 

In the following discussion, we show that if the parameter X m is set to be that in (l22l) . and the dominant 
path is selected by Algorithm [Q then DIS(d s ,t) € M(d s ,t). 

Suppose that v* has k neighbors V\,V 2 ,--- ,in G\, where k > 2. Without loss of generality, 
suppose that the labels are assigned so that d(v, l Vl ) > d(v, l V2 ) > ■ ■ ■ > d(v, l Vk ). We have the following 
elementary result, the proof of which is provided in Appendix ICl 

Lemma 2. Suppose that G is a tree. Given an infection graph G\t, if d(v*,l Vl ) > dfif, l v . 2 ), then at 
least one end of any diameter of G\j is in the subtree T Vl . 

We now show how to find the optimal parameter X m in DlS(d s ,t) so that it achieves a safety margin 
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Strategy 1 Dominant Infection Strategy D1S (d s ,t) 

1: Inputs: G = (V. E), source v*, observation time t, required safety margin d s , set of maximum 
infection rates {A m }, infection rates {A mj } given in (l22l ) . and a dominant path P ( y found by Algorithm 
[T] below. 

2: Output: A (u,v), the infection rate for every (u,v) G GY/,. 

3: for each u € V do 
4: if u G Pd then 

5: Let m = d(v*,i). 

6: If v is the susceptible neighbor of u on Pd, set A (u, v ) = A m . 

7: For any other susceptible neighbor v of u not on Pd, set A (u, v ) = A“® where j = d(u, v), and 

pass the message (m, 1) to v. 

8: else 

9: Let ( a u ,b u ) be the message received by u. For any susceptible neighbor v of u, set A (u,v) = 

A° is b . Pass the message (a u , b u + 1) to v. 

10: end if 

11: end for 

12: return {A (u,v) : (u,v) G GY/} 



Fig. 1. Illustration of the infection graph G\. 


d s . From Lemma |T] we have 


d(v*,l Vl ) = d(t). 


(14) 
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Let l Vl be a leaf node so that p(v*,l Vl ) = (uq = v*, u±, ■ ■ ■ , v-d(t) = ^ 1 ) I s the given dominant path Pd. 
For 0 < m < d(v*,l Vl ) — 1, define T Um to be T Um \T Um+1 . Similar to the definition in (fl3l) . let l Um be a 
leaf node in T Um that has maximum distance from u rn . Figure D] shows an illustration of G\.i and T Um . 
For each m > 1, let 

m— 1 

tm=J2 X k 1 ( 15 ) 

k=0 

be the time taken to infect node u m . Suppose the nodes in p(u m , l Um ) are infected at an average rate 
X m with 

diUnrn^Um) — [_ X m (t fm)J • (16) 

Let V(u m ) to be the set of longest paths such that one end of any path D(u m ) € T>(u m ) is l Vl and 
the other end is in T Um . From (1 1 41 ) and (fl6l) . the number of vertices in I)(u rn ) is 

\D(u m ) | — d(l Vl , u m ') -F d(u m , lum) d - 1 

dj(y , l Vl ) d(v , rr m ) F 1 

= d(t) -m+ [X m (t-t m )\ +1- (17) 

Let v(u m ) to be a node in the middle of D(u m ), i.e., v(u m ) £ arg mm veD ( Um j d(v,D(u m )). Since the 
infection is propagated at the maximum rates along P^, we can always choose v(u rn ) £ Pd with 


d(v*,v(u m )) 

— d(v , l Vl ) d(f)(rt m ), l Vl ) 

-l). (18) 

In order to maximize the number of infected nodes, we maximize \D(u m )\. Note that I)(u rn ) is odd, 
because otherwise we can always increase X m so that we have one more node in \D(u m )\, but (fl8l) 
remains the same. Then we have 


= d(v*,l Vl ) - 


\D(u m )\ 


d(v*,v{Um)) 

= d(v*,l Vl ) - 


\D(u m )\ 1 _ 

2 + 2 


= ^ (d(t) + m- [X m (t - t m ) J) • 


(19) 


Since d s > 0, we must have d(v*,l Vl ) > d(v*,l V2 ). From Lemma [U we see that one end of any 
diameter is a l Vl . Then any diameter is in the set of paths U,!!2o 1 71 ('u m ) and the set of Jordan centers 
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is a subset of {v(u m ) : D(u m ) £ Ur«=o ' T> }■ The safety margin requirement is satisfied if the 
right hand side of (fl9l) has value at least d s for every m £ [0, d s ], i.e., 

L Kn(t - t m )\ <h m = d(t) - 2 d s + m. (20) 


To maximize the number of infected nodes at time t, we choose each A m to be as large as possible. 
Therefore, for m £ [0, d s ], we choose A m to be the largest value so that equality holds in (l20l) . i.e., 

A„ = 2^-. (21) 

We then find 5t, m > 0 for j £ [0, h m ] such that 


y! m+j —t t m ^2 ^m+j) 

j&A m j<£A m 

where A m = {j < h m : A m +j > A m }. Such a 5t : m exists because h m < d(t) — m, the longest distance 
the infection can propagate from u m . Finally, we let the infection at each node v £ T Um such that 
d(u m ,v ) = j <h m spread at rate A m +j ~ 8t,m- If m £ (d s ,d(t)), we choose A m +j to be the spreading 
rate for all v £ T Um such that d(u m ,v ) = j. Note that with this choice, v{u rn ) is the Jordan center on 
Pd for all m £ [0, d s ]. 

In summary, for a v £ T Um such that d(u m ,v) = j, we let it infect its susceptible neighbors not on 
the dominant path with rate 


I ^Tn+j fit,mi if j £ -T-m? and 0 ^ TV, ^ d s , 

A° IS , = < (22) 

[A m+ j, otherwise. 

We have the following result. The proof is provided in Appendix iDl 


Lemma 3. Suppose that DISfri,, t) with safety margin d s > 0 has the dominant path Pd■ Then, it 
maximizes the number of infected nodes at time t amongst ad infection strategies with safety margin d s 
and dominant path Pd- 


In the following, we show how to find the optimal dominant path. Given any dominant path Pd = 
(uo = v *,..., ) as an input of DIS(d s ,f) with safety margin d s > 0, we have from (l22l) . that the 

number of infected nodes is given by 

d(t)—l 

m+ Y, \Tu m \. (23) 

m=0 

To find an optimal dominant path so that the above sum is maximized, we use the procedure in 
Algorithm Q] 
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Algorithm 1 Bellman-Ford Dominant Path Finding 
1: Perform a breadth-first search starting at v*, and for each edge (it, w) where d(v*. w) = dfv*. u") + \ < 

d(t), assign the following weight: 

w(u,w ) = |{n G T U \T W : d{v,u ) < h(u)}\ , 


with 


2 : 


h{u) 


d(t ) — 2d s + d(v*,u), if dfv* , it) < 

< 

d(t) — d(v*, u), otherwise. 


Use the Bellman-Ford algorithm 031 to find a maximal weighted path (no ; • u d(t )) starting at 

ito = u*. The maximal weighted path is output as the dominant path, and its weight added to d(t) 
is output as ||DIS(d s ,i)||. 


In Algorithm Q] since the weight we have assigned to each edge (u rn . n rn +\) in the maximal weight 
path found corresponds exactly to |T Um | in (|23T ). the algorithm gives us the optimal dominant path. In the 
first step of Algorithm Q] the weights w(u. w) for all neighbors w of u in T u can be found by performing 
another breadth-first search in the tree T u . The time complexity of the first step is thus 0(n 2 )Q where 
n is the number of vertices within a distance d(t) of v* ||35l . The Bellman-Ford algorithm in the second 
step also has time complexity 0(n 2 ). Therefore, the overall time complexity of Algorithm Q] is 0(n 2 ). 

Lemma [3] and Algorithm [T| then lead to the following result. 

Theorem 3. Suppose G is a tree. For any observation time t and feasible safety margin d s , DIS (d s , t ) G 
.M.(d s , t) if the dominant path is found by Algorithm [7] 

Since ||DIS {d s , t ) || is non-decreasing in t, we can now perform a binary search procedure in Algorithmic 
to determine the smallest t such that ||DIS(d s ,f)|| > n 0 b S . Note that it suffices to perform the binary 
search over the times {t m : m > 1} defined in (IT31) . because for any t G [t m ,tm+i), m > 1, we have 
||DIS(d s ,f)|| = ||DIS(d s ,f m )|| as the right hand side of <f20l ) remains unchanged. Let 

x 0 = min{m : |{i; : d{v*,v) < d(t m )}\ > n obs }, (24) 

Vo = min{m : |{n : d(v*,v) < d(t m ) - 2d s }\ > n 0 b s }- (25) 

'A function is said to be 0(/(n)) if it is upper bounded by kf(n) for some constant k > 0 and for all n sufficiently large. 
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We initialize the search to be over [t Xo . t yo ]. Because not all vertices within distance d(t 0 b s ) are infected 
by DIS(d s ,fobs), while all nodes within distance d(f 0 bs) — 2 d s are infected, we have ||DIS(d s , trJH < 
7i 0 bs < 11DIS(d s , )11. The binary search takes at most 0(logn 0 b s ) search steps. Assuming that the 

tree G has bounded degree f3, in each search step the computation of ||DIS(d s ,f m )|| using Algorithm Q] 
takes at most 0(d 4d ‘ ] n^ b j time complexity. Therefore the overall time complexity to find DIS(d s , t 0 bs) 
is 0(f3 ida n^ hf , log n obs ). 

Algorithm 2 Binary Search for i 0 b s 
1: Initialize x = xo using (l24l) . and y = yo using (l25l) . 

2: while x < y — 1 do 

3: Set m = [~(x + y)/2\. 

4: if ||DIS(d s ,f m )|| < n obs then 

5: Set x = m. 

6 : else 

7: Set y = m. 

8 : end if 

9: end while 

10: return Output t 0 b s = t y . 


B. Homogeneous Infection Rate Bounds 

If A m = A for all m > 0, then d(f) = | AtJ, and it can be shown from 


that for all m and j, 


A° IS ,- = A • min 


[AfJ — 2 d s + m 

J-1 — 


(26) 


• • - | -7 \ , 

J 1 At — m 

i.e., the same rate is used to infect the vertices in the subtree T Um . In this case, the DlS(d s ,t) strategy 
need not pass additional distance information along with the infection. 

C. Infinite Regular Trees 

In the following, we consider the special case where the underlying network is an infinite r-regular 
tree, every node has r > 2 neighboring nodes, and A m = 1 for all m > 0. The fastest infection strategy 
Amax is the one that sets all infection rates to be the upper bound 1. Then the number of nodes infected 
by the fastest infection strategy by time t can be shown to be given by 

r(r -If -2 


|V[(A max )| = 


r - 2 
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t da 


JC v* 


Fig. 2. Illustration of the set of infected nodes by DIS and AD, where JC denotes the Jordan center of the set of infected nodes 
at time t. The set of infected nodes by DIS are all the nodes within the circle with radius t — d s , while the set of infected nodes 
by AD are all the nodes within the circle with radius Li/2J. Since d s is upper bounded by [t/2_|, we have t — d 3 > [f/2j. 


This infection strategy has safety margin 0. Now suppose that the source wishes to achieve a safety 
margin d s < d s in (fl2l) . the set of infected nodes by time t by our proposed DIS(d s ,f) strategy can be 
shown to be all nodes with distance not greater than t — d s from the Jordan center as shown in Fig. [2] 
Then, the number of nodes infected by time t is 

t(t — 1V ds — 2 

= 1 r : 2 —■ 

When d s increases, the radius t — d s decreases, and the number of nodes infected by the maximum 
infection strategy decreases. This is the necessary trade-off between the faster infection spreading speed 
and the larger safety margin of the source. 

The paper lf26l proposes a messaging protocol called adaptive diffusion (AD) under the assumption that 
the network administrator utilizes a ML estimation strategy. AD is a stochastic infection strategy, where its 
safety margin fails in the range [1, [t/ 2j] with probability one. Given any safety margin d s £ [1, |_t/2j ], 
with probability one, the set of infected nodes by time t by AD can be shown to be all nodes with 
distance not greater than [t/2] from the Jordan center as shown in Fig. [2] Then, the number of nodes 
| Vi (AD) | infected by AD by time t satisfies the following bound with probability one: 

r(r — F/2J _ 2 

Vi (AD) | < ^-< |Vi(DIS(d s ,f))|. 

r — 2 

Therefore, our proposed DIS strategy infects at least as many nodes as the AD strategy almost surely. 
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D. Best-response Infection Strategy for the Infection Source 

Theorem [3] shows how to find a maximum infection strategy for a feasible d s . We next identify one 
that maximizes the utility function of the infection source. We first present the following relationship 
between maximum infection strategies of different safety margins. 

Lemma 4. Suppose G is a tree. For any two safety margins d s and d' s , where 0 < d s < d' s < d s , any 
strategy A d a £ M.(d s ,t 0 b s ) infects more nodes than any strategy A# € A4(d' s ,t 0 b s ), i.e., |Vi(A^ s )| > 
\Vi(A d ,)\. 

Proof: From (I2TT) . the average infection rate X m is a non-increasing function of the safety margin. 
Since d s < d' s , the infection rate A .,. in . \ is larger than or equal to that in . \ ,/■ for any 0 m A (lit) — 1. 
However, equality does not hold for all m, because otherwise, A^ ( and A,// lead to the same infection 
graph, which in turn implies that d s = d' s , a contradiction. As a result, we have |Vi(A^)| > |1/ I (A^)|, 
which completes the proof of Lemma [4] ■ 

We now derive the best-response infection strategy based on Lemma [4] Let Ad s £ A4 (d s , t 0 \, s ) be any 
maximum infection strategy. 

Assume that the network administrator uses the estimation radius d a . We first consider the case where 
d a > d s - Since no infection strategies have safety margins greater than d s , the inequality d a > d s always 
holds. As a result, the cost c s (d a ) is always incurred. Therefore, to maximize its utility function, the 
infection source maximizes its reward g s \V\\ by maximizing the number of infected nodes |VJ|. Lemma 
[4] then leads to the conclusion that Ao = A max is a best-response infection strategy. 

Next, consider the case where d a < d s . We claim that a best-response infection strategy is either Ao 
or A,/ a+ 1 . Following Theorem [3j it suffices to prove the claim by showing the following inequalities: 


r U j s{,d a ' ) A. o) > u s [d a , ), 

V d' s € (0, d a ]', 

(27) 

(d a: A^ a _|_i) > u s (d a , A^/), 

V d' s € ( d a + 1, d s \. 

(28) 


We first show the inequality (l27l) . When 0 < d' s < d a , the source incurs a cost of c s (d a ) for both 
Ao and A^. In addition, from Lemma (4j we have |Vf(Ao)| > |V|(A ( /- )|, which in turn shows that the 
inequality (l27l) holds. We next show the inequality (l28l) . When d n + 1 < d' s < d s , the source does not 
incur a cost for both A,/ n + 1 and A,//. From Lemma|4j we have Vi(A (: ; n + 1 ) > |VJ(A^/) |, which shows that 
the inequality (l28l ) holds. This completes the proof for the claim. The following theorem now follows 
immediately. 
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Theorem 4. Suppose that G is a tree. Then, for any estimation radius d a > 0, a best-response infection 
strategy for the infection source is given by 


A* = 


Ao, 

A<t+i, 

A 0 or A do+ i, 
where G J\A(d, i 0 bs) far all d > 0. 


ifc B {d a ) < ff s (|V[(Ao)| - |V [ (A do+1 )|), 
ifc s (d a ) > ff s (|V[(Ao)| - |Vt(A da+1 )|), 
ifc s (d a )= 9s ( |Vi(A 0 )| - |Vt(A da+1 )|), 


V. Nash Equilibrium in a Tree 

In this section, we derive conditions under which a Nash equilibrium for the strategic game played 
by the network administrator and the infection source exists. We also derive explicitly their respective 
strategies at these Nash equilibria. 

Theorem 5. Suppose G is a tree, and d s in (1121) is greater than 0. Then, the strategic game of infection 
spreading and source identification ([7])-© has the following properties: 

(a) Let Ao G Ad(0,f o bs)- The strategy pair (0, Ao) is a Nash equilibrium iff u s { 0, Ai) < it s (0,Ao), he-, 
c s (0) < g s (|Vj(A 0 )| - |Vi(Ai)|) for any A 1 G Ad(l,f 0 bs)- 

(b) For each Ai G Ad (1, f 0 b s ), the strategy pair (0, Ai) is a Nash equilibrium iff u s (0, Aq) < u s (0, Ai) 
and u a (l,Ai) < tt a (0,Ai), i.e„ c s ( 0) > g s (|V[(A 0 )| - |Vi(Ai)|) and g a (l, V[(Ai)) < c a (I/ sp (l)) - 
c a (F sp (0)). 

(c) No other pure strategy Nash equilibria exist. 

Furthermore, if g a (d a , Vj(A)) = g a (d a ) is non-increasing in d a for all infection strategies A, and 
c n (V S p(da)j = c a {d a ) is non-decreasing in d a for all infection strategies A, then the sum utility of 
the t\\>o players is maximized at the strategy pairs (0, Ao) or (0, Af) for all A\ G Ad(l,f 0 bs)- 

The proof of Theorem [5] is provided in Appendix 10 From Theorem© when a Nash equilibrium exists, 
whether a infection source is identified with positive probability or not depends on the relative gains and 
costs of the two players. It is interesting to note that if a Nash equilibrium exists, then the strategy of the 
network administrator in equilibrium has d a = 0, which corresponds to the Jordan center estimator. This 
shows that under the technical conditions given in Theorem © the natural infection source estimator to 
use is the Jordan center estimator, instead of probing a neighborhood set of the Jordan centers. 
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VI. Simulation Results 

In this section, we present simulation results to evaluate the performance of our proposed infection and 
estimation strategies. We first compare DIS with AD, and then show the behavior of the best-response 
infection and estimation strategies under different gains and costs. For simplicity, our simulations are 
performed assuming that g a (-, ■) = g a , c a (V^(d a )) = c a |V sp (d a )|, and c s (d a ) = c s . 

A. Extension to General Networks 

Although the paths along which the infection spreads from the source node forms a tree that is a 
subgraph of the given graph G, finding the best underlying tree over which to perform the infection 
spreading is a NP-hard problem (similar to the procedure used in Algorithm [Q this is equivalent to the 
longest path problem in a weighted graph, which is known to be NP-hard 11351 1. To adapt our proposed 
DIS strategy for general networks, we adopt a heuristic: we first find a breadth-first search tree rooted at 
the infection source and then apply the DIS strategy on this tree. In the following, we show simulation 
results to verify the performance of the DIS strategy in general networks. 

B. Number of Infected Nodes 

We first evaluate the effectiveness of our proposed DIS algorithm in infecting nodes. We perform 
simulations on four kinds of networks: random trees where each node has a degree uniformly drawn 
from the set {2, 3}, scale-free networks If36l with 5000 nodes, the western states power grid network of 
the United States 1371 containing 4941 nodes, and a part of the Facebook network with 4039 nodes 1381 . 

The benchmark we compare against is the AD infection strategy proposed in |[26l . where AD is shown 
to be order-optimal for the source for infinite regular trees (with heuristic extensions to more general 
networks). We let t to be even and A m = 1 for m > 0 in the simulations in order not to conflate the effect 
of the rate bounds with the other factors. Given any observation time t 0 b s , the safety margin d s (AD) 
resulting from the AD falls in the range [l,f 0 bs/2] with probability one, and the set of infected nodes at 
time f 0 bs is 

Ui(AD) = {u G G : d(v,u) < f 0 bs/2}, 

where v is picked uniformly at random from the set of nodes in G with distance d s ( AD) from the 
infection source v*. 

We let the observation time f 0 b s to be 14, 14, 6 and 6 for random trees, the power grid network, scale- 
free networks and the Facebook network, respectively. The observation times for scale-free networks and 
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Fig. 3. Average numbers of infected nodes for DIS and AD for different networks. 

the Facebook network are chosen to be relatively small because these networks are highly connected and 
the average distances between each pair of nodes in the scale-free network and the Facebook network 
are only 4.6 and 5.5 hops, respectively. The safety margin requirement d s is set to be 1,2,... , t 0 bs/2, 
respectively. We run 1000 simulation runs for each kind of network and each value of d s . Fig. [3] shows 
the average number of infected nodes for both DIS and AD. As expected, we see that there is a trade off 
for DIS between the number of infected nodes and the safety margin. We also see that DIS consistently 
infects more nodes than AD. 

C. Best-response Infection Strategy 

We then evaluate the proposed best-response infection strategy on random trees and the Facebook 
network. The observation time t Q b s for each network is chosen as in Section IVI-BI For each value of 
d a £ [0, cT s ], where d s = f 0 bs/2, the best-response infection strategy is given by Theorem 0] We fix the 
gain g s for all cases and vary the cost c s to make it low, medium and high, compared to g s . Specifically, 
we set c s to be 400 g s , 1 200/7., and 2000/7, for random trees, and 50 g s , 500/7, and 1 500/7, for Facebook 
network. Let DIS,;. denote the DIS strategy with safety margin constraint d s . We run 1000 simulation 
runs for each setting and plot the average utility of the best-response infection strategies for the infection 
source in Fig. [4] We observe similar trends from Fig. [4] for both random trees and the Facebook network, 
even though the DIS strategy was derived for tree networks. 

• When the cost c s is low compared to the gain g s , the infection source always chooses DIS(0,i o bs) 
as its infection strategy. As a result, the infection source is identified by the network administrator. 
Flowever, it maximizes its reward by infecting the most number of nodes. 

• When the cost c s is high compared to the gain g s , the infection source chooses DIS((4 + 1, f 0 bs) for 
d a < d s to ensure that the network administrator does not identify it, and chooses DIS(0, t 0 b S ) for 
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(a) Random trees. 
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Fig. 4. Average utility of the best-response infection strategies for the infection source. When c s is low, DIS(0, fobs) is the 
best-response infection strategy for all d a . When c B is high, DIS(d a + l,t 0 bs) are the best-response infection strategies for 
d a < d s , and DIS(0,f O bs) is the best-response infection strategy for d a = d 3 . When c s is medium, DIS(d a + l,f 0 bs) are the 
best-response infection strategies for d a < 2 for random trees and d a < 1 for Facebook network, respectively, and DIS(0,t O bs) 
is the best-response infection strategy for other values of d a . 


d a = d s as it can not find any infection strategy with a safety margin greater than d s (cf. Theorem 

0 . 

• When the cost c s is medium compared to the gain g s , the infection source chooses DIS(d a + 1, f G bs) 
when d a is small. As d a increases, the infection source switches to DIS(0,f o bs) as its infection 
strategy. 

D. Best-response Estimation Strategy 

Lastly, we evaluate the proposed best-response estimation strategy on random trees and Facebook 
network. Given any infection strategy A with safety margin d s ( A) = d s , where d s £ [1. d s ] and d s = 
f 0 b s /2, the best-response estimation strategy is given by Theorem0 We choose n G b s so that it corresponds 
to the same observation time f 0 b s used for each network in Section [VI-BI We fix the cost c a for all cases 
and vary the gain g a to make it low, medium and high, compared to c a . Specifically, we set g a to be 
c a , 50c a and 200c a for random trees, and c a , 500c a and 2000c a for Facebook network. We run 1000 
simulation runs for each setting and plot the average utility of the best-response estimation strategies for 
the network administrator in Fig. [5J We observe the following from Fig. [5] 

• When the gain g a is low compared to the cost c a , the network administrator always chooses d„ to 
be 0 to minimize the cost. As a result, the infection source gets caught only when d s = 0. 

• When the gain g a is high compared to the cost c a , the network administrator always chooses d a to 
be d s . As a result, the overall cost increases with d s as more nodes need to be investigated, which 
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Fig. 5. Average utility of the best-response estimation strategies for the network administrator. When g a is low, d a is chosen 
to be 0 for all d 3 . When g a is high, d a is chosen to be d„ for all d s . When g a is medium, d a is set to be d a for d s < 4 for 
random trees and d a < 1 for Facebook network, respectively, and d a is set to be 0 for other values of d 3 . 


in turn decreases the utility of the network administrator. Moreover, the infection source always gets 
caught in this case. 

• When the gain g a is medium compared to the cost c a , the network administrator chooses d a to be d s 
when d s is small and the gain of identifying the infection source is higher than the cost of investigat¬ 
ing more nodes. When d s increases to a point that the increase in cost of investigating V r sp (rl„)| — 1 
more nodes exceeds the gain of identifying the infection source, the network administrator chooses 
d a to be 0. 

E. Incomplete Observations 

In this paper, we have assumed that the network administrator can observe all the infected nodes. 
In this subsection, we evaluate the robustness of the Jordan center based estimation strategy and DIS 
infection strategy when only a subset of the infected nodes are observed by the network administrator. 

Let a be the percentage of infected nodes that are randomly observed by the network administrator, 
and let JC(a) be the Jordan center of the set of observed infected nodes. Note that JC(a) may be different 
from the Jordan center of all infected nodes JC. Therefore, the distance d(v*, JC(a)) can differ from d s . 
The network administrator can identify the infection source when d(u*, JC(a)) < d a . 

We perform simulations on random trees, scale-free networks, the power grid network and the Facebook 
network. We set g s = 1 and c s to be 1200, 6000, 1600 and 3000 for random trees, scale-free networks, 
the power grid network and the Facebook network, respectively. For the network administrator, we let the 
gain g a to be medium compared to c a . Specifically, we set c a = 1 and g a to be 50, 1500, 200 and 500 for 
random trees, scale-free networks, the power grid network and the Facebook network, respectively. The 
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Random Trees Power Grid Scale-free Facebook 
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565.0 

73.7 

-282.2 

-540.4 

-728.3 

-869.4 

-919.0 

-714.7 

-155.6 

-195.2 

-237.5 

-262.4 

-345.0 

-466.6 

-602.1 

-771.5 
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2725.2 
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463.3 
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224.6 
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1179.2 
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4622.2 

4555.2 

4465.2 
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2552.9 

2514.1 
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468.1 
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225.8 

151.7 

1250.8 
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1935.0 
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914.7 

657.8 
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4756.4 

3936.4 

2768.7 

2730.0 

2516.5 

1844.5 

8 

530.4 

54.3 

-291.7 

-544.1 

-732.9 

-872.7 

-974.2 

-1048.3 

-319.8 

-327.7 

-356.1 

-408.3 

-483.3 

-584.6 

-742.6 

-937.2 









7 

530.4 

54.3 

-291.7 

-544.1 

-732.9 

-872.7 

-974.2 

-1048.3 

-262.2 

-270.1 

-301.7 

-369.9 

-460.9 

-575.0 

-737.8 

-934.0 









6 

530.4 

54.3 

-291.7 

-544.1 

-732.9 

-872.7 

-974.2 

151.7 

-87.8 

-106.9 

-156.1 

-230.7 

-364.9 

-493.4 

-712.2 

662.8 









5 

530.4 

54.3 

-291.7 

-544.1 

-732.9 

-872.7 

225.8 

151.7 

126.6 

126.7 

66.3 

-77.1 

-228.9 

-416.6 

857.4 

662.8 









4 

530.4 

54.3 

-291.7 

-544.1 

-732.9 

327.3 

225.8 

151.7 

419.4 

368.3 

298.3 

158.1 

-32.1 

1010.6 

857.4 

662.8 

-1053.2 

-1094.2 

-1187.6 

-2006.3 

-182.2 

-254.2 

-485.4 

-1165.4 

3 

530.4 

54.3 

-291.7 

-544.1 

467.1 

327.3 

225.8 

151.7 

694.6 

646.7 

575.1 

406.1 

1111.9 

1010.6 

857.4 

662.8 

-555.2 

-596.2 

-803.6 

-2006.3 

63.8 

-56.2 

-437.4 

-1162.4 

2 

530.4 

54.3 

-291.7 

655.9 

467.1 

327.3 

225.8 

151.7 

937.8 

869.1 

813.5 

1177.3 

1111.9 

1010.6 

857.4 

662.8 

2336.8 

2277.8 

426.4 

3993.7 

1122.8 

489.8 

-203.4 

1834.6 

1 

530.4 

54.3 

908.3 

655.9 

467.1 

327.3 

225.8 

151.7 

1091.4 

1051.5 

1219.9 

1177.3 

1111.9 

1010.6 

857.4 

662.8 

4454.8 

4413.8 

4740.4 

3993.7 

2304.8 

1434.8 

2502.6 

1834.6 
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Fig. 6. Average utility of the infection source for various observation percentage a. The color scale of the heat map is calibrated 
for each kind of network respectively. 


observation threshold n 0 b s for each network is chosen to correspond to the same observation time f obs 
used in Section lYI-BI For each kind of network, we run 1000 simulations for each value of d s £ [0, d s ], 
d a £ {0,1, • • • , d s + 1} and a £ {1,10, 50}, where d s = t 0 b s /2. For each simulation run, we randomly 
pick a percent of infected nodes as observed nodes, compute the realized utility values of the network 
administrator and infection source, and average them over the simulation runs. In the realized utilities we 
compute, the network administrator obtains a gain g a while the infection source incurs a cost c s , only 
when d(v*, JC(a)) < d a . The average utilities of the infection source and the network administrator are 
shown in Fig. [6] and Fig. [7J respectively. 

Consider the utility of the infection source in Fig. [6] The best-response of the infection source is still 
choosing d s to be either 0 or d a + 1. This implies that the result of Theorem [4] is robust for the tested 
networks even though only a subset of infected nodes can be observed. 

Fig. [7] shows the utility of the network administrator. For random trees, the best-response of the network 
administrator is still choosing d a to be either 0 or d s , which verifies Theorem [T| in the case where only 
partial observations are available. On the other hand, for general networks with incomplete observations 
of the set of infected nodes, it becomes more difficult for the network administrator to correctly identify 
the infection source. The network administrator needs to increase d a in order to have a higher chance 
of identifying the infection source. However, for dense networks, the cost of probing more nodes can 
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Fig. 7. Average utility of the network administrator for various observation percentage a. The color scale of the heat map is 
calibrated for each kind of network respectively. 


increase very quickly as d a increases. As a result, for scale-free networks and the Facebook network, 
the network administrator tends to choose d a to be 0 to minimize the cost instead. In practice when 
the network administrator cannot observe all node status, in order to reduce its probing cost, it needs 
to formulate an estimation strategy that incorporates other side information. For example, in trying to 
identify the source of a computer virus, part of the cost of examining every node in the suspect set can 
be reduced by only examining known weak points in the network or by performing a forensic analysis 
of the virus code to reduce the suspect set size. 

VII. Conclusion 

We have formulated the problems of maximizing infection spreading and source identification in a 
network as a strategic game. Conditioned on the strategy of the other player, we proposed best-response 
strategies for both the infection source and the network administrator in a tree network. We also derived 
conditions under which a Nash equilibrium exists. In all Nash equilibria, the Jordan center estimator is 
the equilibrium estimation strategy for the network administrator. We showed that the sum utility of both 
players is maximized at one of these Nash equilibria. 

In this work, we have assumed that the underlying network is a tree. Obtaining theoretical results for 
general networks seems unlikely due to difficulties in designing an optimal infection strategy in a loopy 
graph. Future work includes designing best-response strategies for the network administrator under a more 
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general class of estimation strategies that may not be based on the Jordan center. It would also be of 
interest to study the best-response infection and estimation strategies when infection rates are stochastic 
and not fully controllable by the infection source, or when additional side information is available to the 
network administrator. We have also adopted a simple game theoretic formulation in this paper where the 
network administrator makes a one-shot observation of the network. It would be of interest to consider 
cases where the network administrator can observe the evolution of the network f39ll . l40l by formulating 
a multi-stage game. 


Appendix A 
Proof of Theorem [2] 

We prove Theorem [2] in two steps. We first show that there exists at least one infection strategy that 
can achieve d s = d s . We then show that there is no infection strategy that results in d s > d s . 

Step 1 : We only need to find one infection strategy that has safety margin d s = d s . Let u € V be a 
node with d(v*,u) = d(t), and let D be the path from v* to u. Consider the following infection strategy: 
set the infection rate of each edge in D to be the respective maximum infection rate, and set the infection 
rates of other edges not in D to be 0. We then have d s = \d(t)/ 2j = d s . 

Step 2: Assume d s > d s , i.e., d s > d s + 1. Consider any infection strategy A and a Jordan center 
u such that d(v*,u) = d s and let D = ..., u,..., I 2 ) be a diameter of Gt containing u, where 

l\ and I 2 are leaf nodes, with d(l\,v*) < d(l 2 ,v*). We first show that d(v*,u ) < d(l 2 ,u). It can be 
shown that d(l\,u) and d(l 2 ,u) differs in value by at most 1 fT8ll . If d(l\,u) = d(l 2 ,u) + 1, consider 
the neighbouring node u' of u on the path p(u. l\ ). From Ifl8l , we obtain that v! is a Jordan center 
with d(v*,u') = d s — 1, a contradiction. Therefore, we have d(li,u) < d(l 2 ,u). It is easy to see that 
d(v*,u ) < d(l 2 ,u) because otherwise, the path with p(v*,u) concatenated with p(u, I 2 ) has length greater 
than that of D, a contradiction. We then have 

d(v*,l 2 ) = d(v*,u) + d(u, l 2 ) 

> 2 d(v*,u) 

> 2(4 + 1 ) 

> d(t) + 1, 

a contradiction since the infection can travel at most d(t) hops in time f. This shows that no infection 
strategy results in d s > d s . The proof for Theorem [2] is now complete. 
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Fig. 8. Illustration of part of the infection graph G\. 


Appendix B 
Proof of Lemma |T] 

We call the leaf node l d of a dominant path a dominant leaf. We prove Lemma Q] in two steps. We first 
show that any diameter D of G\j contains at least one dominant leaf. We then show that the infection 
rate associated with each edge in any dominant path is its upper bound A m . 

Step 1 : Show that any diameter D of G\ d contains at least one dominant leaf. 

Let l\ and l 2 to be the two end nodes of D. Let v, and Vj to be two different neighboring nodes of 
v*. We consider two possible scenarios: l\ and I 2 are in different subtrees T Vi and T Vj , respectively; l\ 
and I 2 are in the same subtree T v .. 

SCENARIO 1: l\ and 1.2 are in different subtrees T v . and T v ., respectively. 

Suppose D does not contain any dominant leaf. Then we can find a dominant path [>(v*. Id) such that 
l d £ T v . (if Id £ T Vi , we have Id f T v . and just exchange the notations i and j). Consider the path 
D' = {h, ■■■ ,l d }, we have 

\D'\ =d(v*,h) + d(v*,l d ) + l 
> d(v*,h) + d(v*,l 2 ) + 1 
= \D\. 

Thus, we find a path D' that has longer distance than the diameter D, a contradiction. So D must contain 
at least one dominant leaf. 

Scenario 2: li and l 2 are in the same subtrees T Vi . 

Suppose D does not contain any dominant leaf. Consider a dominant leaf l d . If l d £ T v ., following the 
same argument as in Scenario 1, we can find a path D' = {Zi, • • • ,v*, - ■ ■ ,l d } that has longer distance than 
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D. We now consider the case where Id £ T v . . Let u x to be the first node on which the two paths p(l\,v*) 
and p(l 2 ,v*) intersects, where x is the depth of u x and 1 < x < mm{d(v*,h) — l,d(v*,l 2 ) — 1}- Then 
let u y to be the first node on which the two paths p{l\,v*) and p(ld- v*) intersects, where y is the depth of 
u y and 0 < y < d(v*, l\) — 1. Figure [8] shows all three possible cases: y > x,y = x and y < x. Consider 
the path D' = {Id,-" ,Ux, m " ,fa}- For case 1 and case 2 in Figured! we have d(u x ,ld ) > d(u x ,l i) 
because d(v*,ld ) > d(v*,l i). Similarly, for case 3 in Figured! we have d(u x , Id) > d(u y , Id) > d(u y , h). 
As a result, for all three cases, we have 

\D | — d(u x , Id) T d(u x , I 2 ) T 1 
^ d(u x , l\) T d(iL x , I 2 ) T 1 

= \D\. 

We find a path D' that has longer distance than the diameter D, a contradiction. We can now conclude 
that any diameter D of Gj./ contains at least one dominant leaf. 

Step 2: Show that the infection rate associated with each edge in any dominant path is its upper bound 

m■ 

Consider any dominant path Pd = p(v*,ld) and suppose the infection rate of some edges in P c i are 
less than A m . Let D = {Id, ■ ■ ■ , u x , ■ ■ ■ , I 2 } to be the diameter containing Id as shown in Figured) where 
x > 0 is the depth of u x . Consider a Jordan center u such that d(v*,u) = d s . It is easy to see that u 
is at the middle of the diameter. Since d(v*,U) > d(v*,l 2 ), we have d(u x ,ld) > d(u x ,l 2 ), which in 
turn implies that u € p(u x ,ld). If we increase the infection rates of all edges in P,/ to their maximum 
rates, the length of Pd will increase and u will move further away from v*, i.e., the safety margin will 
increase as well. We can then increase the infection rates of some edges in the path p(u x ,l 2 ) to increase 
the length of p(u x , ^)- As a result, u will move closer to v* and the safety margin can reduce back to its 
original value. In this case, we find another infection strategy that results in more infected nodes subject 
to the same safety margin d s , a contradiction. We can now conclude that the infection rate associated 
with each edge in any dominant path is its maximum rate. This completes the proof of Lemma [T] 

Appendix C 
Proof of Lemma [2] 

Fix any diameter and let it be D. We prove Lemma [2] by contradiction. Suppose neither end of D is 
in the subtree T Vl , then there are two possible cases: (1) both ends of D are in the subtree T v ., where 
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Fig. 9. Illustration of the diameter containing the dominant leaf Id- 

2 < i < A:; (2) the two ends of D are in the subtree T v . and T Vj , respectively, where 2 < i,j < k and 

* + 3- 

We first consider case (1) and let l\ and I 2 to be the two ends of D. Consider two paths p(l\,v*) 
and p(l 2 ,v*) and let the first node on which these two paths intersect as w. We can find a path D' = 
{l Vl , ■ ■ ■ , v*, ■ ■ ■ , w, ■ ■ ■ J 2 } that has longer distance than D. We have 

,tn}| 

= d(v*, l Vl ) + 1 

> d(v*,l Vi ) + 1 

> d(h,u ) + 1 
= ,«}|- 

Then we have 

\D'\ = | {l Vl ,--- ,u}\ +d(u,h) 

> \{h, ■■■ ,u}\ + d(u,l 2 ) 

= \D\. 

We find a path that has greater length than the diameter, which contradicts with the definition of diameter. 
This completes the proof for case (1). 

We then consider case (2). Fix i and j, and let l- t and lj denote the two ends of the diameter in subtree 
T v . and T Vj , respectively. Since d(v*,l Vl ) > d(v*,l Vi ), the length of the path D' = {l Vl , • • • , v*, ■ ■ ■ ,l Vj } 
is greater than the length of diameter D = {l v ., • • • , v *, • • • which contradicts with the definition 

of diameter. This completes the proof for case (2), and the proof for Lemma [2] is now complete. 
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Appendix D 
Proof of Lemma [3] 

Consider any infection strategy A with safety margin d s , a dominant path P ( j, and that maximizes 
the number of infected nodes. We use the same notations in the discussion preceding Lemma [3j with 
Pd = ('»(),..., u ( ]( t \). In addition, let T U (G) be the subtree of G rooted at node u with the first link in 
the path from u to v* removed. Let T Um (G ) be T Um (G)\T Um+1 (G). 

Suppose there exists a m £ [0, d s ] such that for a path p{u m , l Um ), we have d(u m ,T Um (G )) > X' m (t — 
t m ), and \' m > \ m , where 

Xm = ^( u rn^« m ) I ^ ^ X(i,j ) 

V(*d)ep(u m ,L m ) 

i.e., X' m is the average infection rate along the path p(u rn . l Um )- (Recall that \ m is the average infection 
rate used by DlS(d Sl t) for T Um (G).) We have 

since otherwise, we can infect more nodes, contradicting the assumption that A maximizes the number 
of infected nodes. We also have v{u m ) is a Jordan center. By replacing A m with \' m in (fT9l) . we have 
d(v*, v{u m )) < d s since X' rn > X m implies that the inequality in (l20l) is reversed when X m is replaced 
by X' m . This contradicts the assumption that A has safety margin d s . 

On the other hand, if d(u m ,T Urn (G)) < X[ ri (t -t rn ), i.e., all the nodes in T Um are infected by A before 
time t, then we can choose a A^ £ (A^, X m ), infect all the nodes in T Um by time t, and repeat the above 
argument using A", in place of X' m . Therefore, no other strategy can infect more nodes than DIS(ri s , t), 
and the proof is complete. 



Appendix E 
Proof of Theorem [ 5 ] 

We first prove the properties da])-(Ic]) in sequence. We then prove the sum utility optimality claim. 

Proof of Theorem |5 l| a l) . 

Following the definition of the Nash equilibrium, it suffices to show that 

U a {0, A 0 ) > u a (d a , A 0 ), Vd a > 0, (29) 

u s (0,A 0 ) >« a (0,A), VA. (30) 
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The inequality ( l29t follows from Theorem [Q To show (l30l) . let A be any infection strategy, and d s be 
its safety margin. If d s = 0, we obtain from Lemma 0 ] 

u s { 0,A 0 ) = 5 a|Vt(A 0 )| -c s (0) 

> 5s |V[(A)|-c s (0) 

= u s ( 0, A). 

If d s > 0, from the assumption of Theorem [5lfaD and Lemma 0 we have for any Ai £ A4 (1), 

u s (0, A 0 ) > tt s (0, Ai) 

= <fc|V[(Ai)| 

>S-|Vt(A)| 

= tr s (0, A). 

The proof of Theorem Bilal ) is now complete. 

Proof of Theorem l5lfbl ). 

It again suffices to show that for Ai £ Ad(l,£ 0 bs) satisfying the assumptions of Theorem 010). we 
have 

Ma(0, Ai) > u a (d a , Ai), Md a > 0, (31) 

« S (0,A!) >w fl (0,A), VA. (32) 

From the second assumption of Theorem 010. for any d a > 0, we have 

U a ( 0, Ai) > U a (l, Ai) 

= -C a (Kp(l))+5a(l,Vi(Al)) 

> -c a (V sp (d a )) + g a (d a , Vi(Ai)) 

— (d a , Ap), 

and inequality (f3Tb holds. 

We now show (l32l) . Let A be any infection strategy and d s be its safety margin. If d s = 0, from the 
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first assumption of Theorem l5llbl) . and Definition [Q we have 

u s (0, Ai) > u s (0, A 0 ) 

= 5s |V[(Ao)|-c s (0) 

>^|V1(A)|-c s (0) 

= u s ( 0, A). 

If d s > 0, from Lenmia 01 we have 

u s ( 0, Ai) = g s |V[(Ai)| 

><fc|V[(A)| 

= u s ( 0, A). 

We have now shown that (l32l) holds and the proof of Theorem l5Hbl) is complete. 

Proof of Theorem |U|c]). 

Consider any strategy pair (d a , A) ^ (0,Ao) or (0, Ai) for all Ai G Ad(l,f 0 bs)- Let d s be the safety 
margin of A. If d a = 0 and d s = 0, then 

u s (0, A) = g s |Vi(A)| - c s (0) 

< ffs|I / i(Ao)| - c s (0) 

= u s (0, A 0 ), 

so (d a , A) is not a Nash equilibrium. If d a = 0 and d s > 1, we have u s (0,A) = y s |Vj(A)| < <? s |Vi(Ai)| 
for any Ai G A4(l,f 0 bs)- This again implies that (d a , A) is not a Nash equilibrium. 

Now suppose that d a > 0. From Theorem 01 it suffices to show that (d a ,Ao) and (d a , A^+i) for all 
Ad a +i G M(d a + I;fobs) are not Nash equilibria. We have 

A. q) C a (F S p(d 0 )) + 9a{d a , F^Ag) 

< — C a (I4p(0)) + 5a(0, I'i(Ao)) 

= u a (0, A 0 ), 

where the inequality follows from the assumption that d s > 0. For each A^+i G M(d a + l,f obs ), we 
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have 


Ha{d a , A^+i) — Ca{Vsp(d a T 1)) 

< -Ca(V r sp (0)) 

— ^a(O) ■^■da+l)' 

This completes the proof of Theorem l5llcD . 

Proof of sum utility optimality. 

It suffices to show that for any strategy pair (d a , A) and every Ai G A4( 1, t 0 bs)* we have 

u a (d a , A) + u 3 (d a , A) < max{u a (0, A 0 ) +u s (0,A 0 ), u a (0, A x ) + u s (0, Ai)}. (33) 

Let d s be the safety margin of A. We first consider the case where d a < d s . Following ©, lUJ), 
Definition Q] and Lemma [4] we have for any Ai € AT(1. f 0 b s ), 

(^ai A') T u s (d a , A) — c a ( d a ) T g s | Vj(A) | 

< —c a (0) +g s |Vi(Ai)| 

= ti a (0, Ai) + u 8 (0, Ai). 


This implies that (1331) holds for all Ai G A4 (1, t 0 b s ). 

Suppose now that d a > d s . Following ([7]), ©, Definition [I] and Lemma |4j we have 

( d a i A) + u s ( d a , A) — c a (d a ) T g a ( d a ) T g s | Vj(A) | c s (da) 

< -c a (0) + g a { 0) + p s |Ii(A 0 )| - c s (0) 

= u a (0, A 0 ) +u s (0,A 0 ). 

This implies that (1331) holds. The proof of Theorem [5] is now complete. 
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